shell企业重要脚本

1.主机状态监测脚本 *****
vim server.sh
#!/bin/bash
cpu=top -b -n1 | grep Cpu | awk -F, '{print $1}'| awk '{print $2}'
disk=df -Th | grep "/$" | awk '{print $6}'
mem=$(free |awk '/Mem/{print $3/KaTeX parse error: Expected 'EOF', got '}' at position 6: 2*100}̲') rx=(ifconfig ens33 | grep RX | sed -n ‘1p’ | awk ‘{print $(NF-1),$NF}’)
tx=$(ifconfig ens33 | grep TX | sed -n ‘1p’ | awk ‘{print $(NF-1),$NF}’)
echo “CPU used：$cpu%”
echo “disk used: $disk"echo"memused：$mem%”
echo “网卡流入的量为：$rx"echo"网卡流出的量为：$tx”
保存退出

sh server.sh

2.巡检脚本检查存活主机和危险端口

（1）检查存活主机
前提：
ssh 互信：
ssh-keygen
ssh-copy-id root@192.168.8.20

安装nmap: yum -y install nmap

cat > /etc/hosts << EOF
192.168.8.20 web2
192.168.8.30 web3
EOF

vim /root/ip_active.sh
#!/bin/bash
while read line
do
hostname=echo $line | cut -d " " -f 2
ip=echo $line | cut -d " " -f 1
ping -c 3 $ip &>/dev/null
if [ $?-eq0]thenecho"==========================================="echo"hostname:$hostname ip:$ip active:up!"
scp /root/check.sh $ip:/root/ &>/dev/null
ssh -Tq $ip<<aaash/root/check.shaaaecho"==========================================="elseecho"==========================================="echo"hostname:$hostname ip:$ip active:down!"
echo “===========================================”
fi
done < /etc/hosts

（2）高危端口扫描
vim check.sh
#!/bin/bash
while read line
do
ip=echo $line | cut -d " " -f 1
hostname=echo $line | cut -d " " -f 2
echo “--------------$hostname,$ip---------------”
nmap -sS $ip
nmap -sS $ip > /root/port_echo $ip
cat /root/port_echo $ip | grep 135/tcp &>/dev/null
if [ $? -eq 0 ]
then
echo $ip"已开启TCP135高危端口，用于RPC（远程过程调用）服务。"
fi
cat /root/port_echo $ip | grep 21/tcp &>/dev/null
if [ $? -eq 0 ]
then
echo $ip"已开启TCP21高危端口，用于FTP连接控制和数据传输任务。"
fi
cat /root/port_echo $ip | grep 22/tcp &>/dev/null
if [ $? -eq 0 ]
then
echo $ip"已开启TCP22高危端口，为SSH端口，可以访问物理服务器硬件的远程shell。"
fi
cat /root/port_echo $ip | grep 23/tcp &>/dev/null
if [ $? -eq 0 ]
then
echo $ip"已开启TCP23高危端口，主要用于Telnet（远程登录）服务，是Internet上普遍采用的登录和仿真程序。"
fi
cat /root/port_echo $ip | grep 53/tcp &>/dev/null
if [ $? -eq 0 ]
then
echo $ip"已开启TCP53高危端口，通常被用来执行区域传送、DNS劫持、缓存投毒、欺骗以及各种用于DNS隧道的远程控制。"
fi
cat /root/port_echo $ip | grep 1080/tcp &>/dev/null
if [ $? -eq 0 ]
then
echo $ip"已开启TCP1080高危端口，是Socks代理服务使用的端口。"
fi
cat /root/port_echo $ip | grep 3389/tcp &>/dev/null
if [ $? -eq 0 ]
then
echo $ip"已开启TCP3389高危端口，是RDP(远程桌面)的默认端口。"
fi
done < /etc/hosts

3.脚本切割nginx日志 *****
wget -O /etc/yum.repos.d/epel.repo https://mirrors.aliyun.com/repo/epel-7.repo
rm -rf /var/run/yum.pid
yum -y install nginx
systemctl start nginx
echo “

www.nginx.org

vim /root/cut_nginx_log.sh
#!/bin/bash
LOG_PATH=/var/log/nginx/
PID=/var/run/nginx.pid
mv ${LOG_PATH}access.log KaTeX parse error: Expected group after '_' at position 17: …LOG_PATH}access_̲(date +%F).log
mv ${LOG_PATH}error.log KaTeX parse error: Expected group after '_' at position 16: {LOG_PATH}error_̲(date +%F).log
kill -USR1 cat ${PID}
保存退出

chmod +x /root/cut_nginx_log.sh

crontab -e
59 23 * * * /bin/bash /root/cut_nginx_log.sh

4.网段主机存活探测
vim read2-2.sh *****
#!/bin/bash
IP=192.168.8.
for i in {1…254}
do
ping -w 1 -c 1 $IP$i &> /dev/null
if [ $? -eq 0 ];then
echo -e “\033[32m $IP$i 可以通信 \033[0m”
else
echo -e “\033[31m $IP$i 不可通信 \033[0m”
fi
done

5.系统初始化脚本（参考）
vim sysinit.sh

#!/bin/bash
#---------------------------------#

适用于CentOS7版本

selinux=grep SELINUX= /etc/selinux/config |awk -F '=' 'NR==2{print $2}'
local_NICNAME=ip addr|grep '^2'|awk -F ': ' '{print $2}'
local_PROFILE=/etc/profile
local_LIMITS=/etc/security/limits.conf
local_SYSCTL=/etc/sysctl.conf
local_CRON=/var/spool/cron/root
#---------------------基础配置---------------------
#关闭防火墙
echo “关闭防火墙”
systemctl stop firewalld.service
systemctl disable firewalld.service
#关闭seLinux
echo “关闭seLinux”
setenforce 0
if [ KaTeX parse error: Expected 'EOF', got '#' at position 40: …then sed -i 's#̲selinux#disabled#g’ /etc/selinux/config
else
echo “seLinux已关闭”
fi

#更换yum源
echo “更换yum源”
if [ -d /etc/yum.repos.d ];then
yum install -y wget
cd /etc/yum.repos.d
mkdir repo_bak
mv * repo_bak
wget -O /etc/yum.repos.d/CentOS-Base.repo http://mirrors.aliyun.com/repo/Centos-7.repo
wget -O /etc/yum.repos.d/epel-7.repo http://mirrors.aliyun.com/repo/epel-7.repo
yum clean all
yum makecache
else
echo “/etc/yum.repos.d目录不存在”
mkdir /etc/yum.repos.d/
cd /etc/yum.repos.d/
curl -o /etc/yum.repos.d/CentOS-Base.repo http://mirrors.aliyun.com/repo/Centos-7.repo
curl -o /etc/yum.repos.d/epel-7.repo http://mirrors.aliyun.com/repo/epel-7.repo
yum clean all
yum makecache
fi

#安装常用软件
yum install -y vim lrzsz yum-utils telnet ntpdate bash-completion.noarch iotop
#改网卡名称为eth0
if [ $loca{l}_{N}ICNAME!="eth0"];thenecho"网卡名称为$local_NICNAME"
sleep 5
sed -i s/“^NAME=.*$"/"NAME=eth0"/g/etc/sysconfig/network-scripts/ifcfg-$local_NICNAME
cp /etc/sysconfig/network-scripts/ifcfg-$loca{l}_{N}ICNAME/etc/sysconfig/network-scripts/ifcfg-$local_NICNAME.bak
mv /etc/sysconfig/network-scripts/ifcfg-$loca{l}_{N}ICNAME/etc/sysconfig/network-scripts/ifcfg-eth0sed-is{/}^{\prime }rhgbquiet"$'/'net.ifnames=0 biosdevname=0 rhgb quiet”'/g /etc/default/grub
grub2-mkconfig -o /boot/grub2/grub.cfg
else
echo"网卡名称已经是etho0"
fi
echo “alias eth0=‘vim /etc/sysconfig/network-scripts/ifcfg-eth0’” >> ~/.bashrc

#安装jdk
which java
if [ $? -ne 0 ];then
if [ -e /opt/jdk-8u311-linux-x64.tar.gz ];then
cd /opt
tar xf jdk-8u311-linux-x64.tar.gz
chown -R root.root jdk1.8.0_311
echo “配置jdk环境变量”
echo “#jdk” >> $local_PROFILE
echo “export JAVA_HOME=/opt/jdk1.8.0_311” >> $loca{l}_{P}ROFILEech{o}^{\prime }exportPATH=$JAVA_HOME/bin:$PATH’ >> $loca{l}_{P}ROFILEech{o}^{\prime }CLASSPATH=.:$JAVA_HOME/lib/dt.jar:$JAVA_HOME/lib/tools.jar’ >> $local_PROFILE
echo ‘export JAVA_HOME PATH CLASSPATH’ >> $local_PROFILE
source $local_PROFILE
else
echo “未找到jdk-8u311-linux-x64.tar.gz包,请将包放到/opt下”
fi
else
echo “系统已安装JDK”
fi
java version
sleep 3
#---------------------系统优化---------------------

#修改命令行格式
echo “export PS1=‘[[\e[34;1m]\u@[\e[0m][\e[32;1m]\H[\e[0m] [\e[31;1m]\w[\e[0m]]\$’” >> $local_PROFILE
#SSH连接速度
echo “UserDNS no” >> /etc/ssh/sshd_config
#修改最大文件打开数
echo “* soft nofile 65535” >> $local_LIMITS
echo “* hard nofile 65535” >> $local_LIMITS
echo ‘* soft nproc 65535’ >> $local_LIMITS
echo ‘* hard nproc 65535’ >> $local_LIMITS
echo “ulimit -n 65535” >> $local_PROFILE
#开启内核转发
echo “net.ipv4.ip_forward = 1” >> $local_SYSCT
sysctl -p

#最大PID数
echo “kernel.pid_max= 111111” >> $local_SYSCT
#关闭NetworkManager
systemctl stop NetworkManager
systemctl disable NetworkManager
#时间同步
systemctl start ntpdate
systemctl enable ntpdate
echo “每五分钟同步一次时间” >> $local_CRON
echo “*/5 * * * * /usr/sbin/ntpdate ntp1.aliyun.com >/dev/null 2>&1 &” >> $local_CRON

#配置常用软件源
#docker
yum-config-manager --add-repo http://mirrors.aliyun.com/docker-ce/linux/centos/docker-ce.repo
#nginx
cat > nginx.repo << EOF
[nginx]
name=nginx repo
baseurl=http://nginx.org/packages/centos/$releasever/$basearch/
gpgcheck=0
enabled=1
EOF
yum clean all
yum makecache fast

#重启服务器
while true
do
read -p "选是否立刻重启服务器(y/n): " choice
if [ $choice == “y” ];then
echo “5秒后重启”
sleep 5
reboot
else if [ $choice == “n” ];then
echo “5秒后退出”
sleep 5
exit
else
echo “输入错误,重新输入”
continue
fi
fi
done
#---------------------END---------------------

6.使用root清空/var/log/messages，但保留最近100行
思路：
判断用户是root
判断文件是否存在
清空保留最近100行

vim log.sh ***
#!/bin/bash
if [ $UID -eq 0 ] && [ KaTeX parse error: Expected group after '_' at position 98: …ar/log/messages_̲(date +%F).bak
tail -100 /var/log/messages_$(date+echo"------成功-------"elseecho"文件/var/log/messages不存在"fielseecho"$USER 没有此权限"
exit
fi

7.mysql分库分表备份脚本
vim for1.sh *****
#!/bin/bash
db=$(mysql -uroot -p123 -e “show databases;”|sed 1d|grep -Ev “.*_schema|sys|mysql”)

for dbname in $dbdobackdir=/backup/mysql/$dbname
if [ ! -d $backdir ];then
mkdir -p $backdir
fi
mysqldump -uroot -p123 -B $dbname > $backdir/${dbname}db$(date+echo"$dbname 数据库已经备份完成"

table=$(mysql -uroot -p123 -e "use ${dbname};show tables;"|sed 1d)
for tablename in $table
do
	mysqldump -uroot -p123 $dbname $tablename > $backdir/${dbname}_${tablename}_table_$(date +%F).sql
	echo "$dbname 库的 $tablename 表 已经备份成功"
done

done

8.自动化ssh免密 ******
yum -y install expect
ssh-keygen

#!/bin/bash
SERVERS=“192.168.8.20 192.168.8.30”
PASSWD=“123456”

function sshcopyid
{
expect -c "
set timeout -1;
spawn ssh-copy-id KaTeX parse error: Expected group as argument to '\"' at position 63: … \"yes/no\" ̲{ send \"yes\r\…PASSWD\r";exp_continue; }
};
expect eof;
"
}

for server in $SERVERS
do
sshcopyid $server

done